Reset of default domain policy/internet explorer maintenance settings

Question

Reset of default domain policy/internet explorer maintenance settings

Aspall IT 436

Hello,

I have taken over an existing Active Directory domain at my company.
I am doing a tidy and consolidation of group policy objects, and one of the ones I want to sort is the default domain policy.

The policy has had Internet Explorer Maintenance settings applied, but because our domain controllers are all 2016 and above, and all our clients are Windows 10, I have nothing that is able to see those settings for me to clear out of the policy.

I toyed with the idea of manually recreating the policy, however one of the default settings in the domain policy looks to be a encrypting file system certificate, which I don't know how to manually recreate in a new policy.

I assume my options are;

Deploy a Windows 7 or 2012 client to manage these settings
Use the gpo fix tool to restore the default policy?

Not sure what the best course of action here is?

Many thanks
James

Accepted answer

3 additional answers

Your answer

Answer 1

Clément BETACORNE 2,496

Hello,

Finally I have tested this solution and it seems to work. I created a new 2008R2 server without any patches to have the oldest version of IE and from this server I edited a GPO and I got the Internet Explorer Maintenance even if I have the central store :

Regards,

James Edmonds 831 Reputation points

2021-12-02T12:00:14.017+00:00

Thank you.

I will see if I can find some 2008 R2 install media and give this a go!

Many thanks.
James
Aspall IT 436 Reputation points

2021-12-02T12:38:10.403+00:00

This has worked perfectly!

I have now been able to reset all IE customisations in the policy, which has removed it from the GPO.
Bit of a faff, but we got there!

Many thanks
James
Gary Reynolds 9,621 Reputation points

2021-12-02T22:27:15.087+00:00

Hi James,

Just for my reference, did you check if NetTools was able to show the IE settings, or do I need to do a code update to display these settings.

Gary.
Aspall IT 436 Reputation points

2021-12-05T23:48:48.94+00:00

I must apologise as I don't recall with 100% certainty.

If memory serves, it did indeed show those IE Maintenance Sections, as I think I went to edit them from NetTools, which then just launched the vanilla GP editor.

Sorry for not being able to say for certain.

Many thanks!
James
Gary Reynolds 9,621 Reputation points

2021-12-06T19:29:40.383+00:00

Thanks James,

When you click the edit option in NetTools it will first try to launch the GPMC version of gpoedit and will fail back to the native gpoedit, if it's not installed.

Gary.

Answer 2

Gary Reynolds 9,621

Hi,

Have look at this option, https://nettools.net/gpo-explorer/, I haven't used it to look at the ie maintenance settings before, but as it shows the raw data in the policies it might be able to show you what is in policy.

Gary.

Aspall IT 436 Reputation points

2021-11-18T12:42:38.713+00:00

Thanks, but sadly the edit functionality is still provided by gpedit, which no longer includes Internet Explorer Maintenance, so I cannot remove those parts of the GPO.

Cheers
James
Gary Reynolds 9,621 Reputation points

2021-11-18T19:31:59.793+00:00

But you don't need to edit the policy you only need to see the settings, as you suggested, once you have the details I would recreate them in new policies and reset the default domain policy. The encryption certificate can be exported from a workstation certificate store and then re-added to a new policy.

Gary.
Aspall IT 436 Reputation points

2021-11-22T11:29:36.487+00:00

Do you suggest using the DCGPOFIX utility to reset the policies once I have migrated settings to new policies?

Do you know what container the EFS certificate would sit in?

Cheers
James

Answer 3

Clément BETACORNE 2,496

Hello,

One option like you describe can be to use a Windows 7 or Windows Server 2012 to edit your GPO but it will not work if you have the central store in place

Cheers,

Aspall IT 436 Reputation points

2021-11-18T15:16:11.487+00:00

Damn, we have a central store.

Any other options you are aware of we can use to clear these elements from this GPO?

Cheers
James
Clément BETACORNE 2,496 Reputation points

2021-11-22T08:30:18.923+00:00

Hello,

Below you will find an update which will help you override the default behavior of the central for Windows 7 or Windows Server 2012, like that you will be able to edit your GPO setting :
https://support.microsoft.com/en-us/topic/an-update-is-available-to-enable-the-use-of-local-admx-files-for-group-policy-editor-24ea6900-fa03-d53f-c666-199e5ac02be9

Regards,
Aspall IT 436 Reputation points

2021-11-22T11:27:02.517+00:00

From where do I get the hotfix it mentions, for server 2012?
The button does not display to download it.

Thanks.
James
Clément BETACORNE 2,496 Reputation points

2021-11-22T14:08:07.827+00:00

If you have an up-to-date Windows 2012 R2 it should work, you will have to create the Group Policy key and create the EnableLocalStoreOverride REG_DWORD and set it to 1
Aspall IT 436 Reputation points

2021-11-22T15:49:49.297+00:00

Thanks, but I didn't think 2012 R2 had IE maintenance GPO extensions, meaning I wouldn't be able to use it as a client to remove these settings from my GPO.
Am I mistaken, and can I use 2012 R2 to manage IE Maintenance policies?

Thanks
James
Clément BETACORNE 2,496 Reputation points

2021-11-22T16:18:21.973+00:00

No you are not mistaken, I'm currently trying to find a 2008R2 without IE 11 to ensure that it will work

Answer 4

Limitless Technology 39,926

Hi there,

Here is a step to reset default domain policy.

Log on as a domain administrator to a DC.
Start a command session.
To reset the Domain GPO, type
dcgpofix /target:Domain
To reset the Default DC GPO, type
dcgpofix /target:DC
To reset both the Domain and Default DC GPOs, type
dcgpofix /target:both
4.After you enter the appropriate command in Step 3, enter Y to both prompts.
Close the command window.

Here is a link as well to help you out https://social.technet.microsoft.com/Forums/windowsserver/en-US/e8a7c194-d3bf-4e1c-857c-7f779cc86705/how-to-reset-default-domain-policy?forum=winserverDS

--If the reply is helpful, please Upvote and Accept it as an answer--

Aspall IT 436 Reputation points

2021-11-22T11:26:29.82+00:00

Thanks.

I have seen this suggested as a "Method of last resort".
Will this also deal with the efs certificate, or will I still have to handle that manually?

Many thanks
James

Share via

Reset of default domain policy/internet explorer maintenance settings

3 additional answers

Your answer